Daily Defender News
Aboutmerill.net
Microsoft Defender for Business
Endpoint protection

Assign Security Roles and Permissions in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

6 October 2026Doc update+10 / −18 lines

In brief

The page received updated internal links, title capitalization, wording, punctuation, and terminology. A navigation section was removed, while the role-assignment instructions remain focused on the Microsoft 365 and Entra admin centers.

What Defender admins need to know

Administrators will see clearer, more streamlined guidance when reviewing Defender for Business role assignments. No action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Assign security rolesSecurity Roles and permissionsPermissions in Microsoft Defender for Business - Microsoft Defender for Business | Microsoft Learn

This article describes how to assign security roles and permissions in Defender for Business.

Visual depicting step 3 - assign security roles and permissions in Defender for Business.

Your organization's security team needs certain permissions to perform tasks, such asas:

  • Configuring Defender for Business
  • Onboarding (or removing)or removing devices
  • Viewing reports about devices and threat detections
  • Viewing incidents and alerts
  • Taking response actions on detected threats

Permissions are grantedYou grant permissions through certain roles in the Microsoft Entra ID. TheseYou can assign these roles can be assigned in the Microsoft 365 admin center or in the Microsoft Entra admin center.

Choose where to assign roles and permissions

Use the following links to learn about Defender for Business roles, manage assignments, and continue to the next steps:

  1. Learn about roles in Defender for Business.
  2. View or edit role assignments for your security team.
  3. Proceed to your next steps.

Roles in Defender for Business

Important

Microsoft recommends that you grant people access to only what they need to perform their tasks. We call thisThis concept is called least privilege for permissions. To learn more, see Best practices for least-privileged access for applications.

You can use the Microsoft 365 admin center or the Microsoft Entra admin center to view and edit role assignments.

| Task | Procedure |
| --- | --- |
| Add a role to a user account | 1. Select **Admin center access**, scroll down, and then expand **Show all by category**.<br>    2. Select one of the following roles:<br>        - Security Administrator (listed under **Security & Compliance**)<br>        - Security Reader (listed under **Read-only**)<br>/ul&gt;<br>    3. Select **Save changes**. |
| Remove a role from a user account | 1. Either select **User (no admin center access)** to remove *all* admin roles, or clear the checkbox next to one or more of the assigned roles.<br>    2. Select **Save changes**. |

Microsoft Entra admin center

Use the following steps in the Microsoft Entra admin center to open a user account and manage assigned roles:

  1. Go to the Microsoft Entra admin center and sign in.
  2. In the navigation pane, go to Users > All users.